WARNING: refcount bug in blk_mq_free

Title	Replies (including bot)	Last reply
[syzbot] WARNING: refcount bug in blk_mq_free_request (3)	0 (1)	2021/06/01 04:47

Title

Replies (including bot)

Last reply

[syzbot] WARNING: refcount bug in blk_mq_free_request (3)

0 (1)

2021/06/01 04:47

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	WARNING: refcount bug in blk_mq_free_request block				1	1973d	1967d	0/26	auto-closed as invalid on 2019/05/29 00:00
upstream	WARNING: refcount bug in blk_mq_free_request (2) block	C	done	error	5	1724d	1724d	15/26	fixed on 2020/06/30 18:57

refcount_t: underflow; use-after-free. WARNING: CPU: 0 PID: 2924 at lib/refcount.c:28 refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28 Modules linked in: CPU: 0 PID: 2924 Comm: kworker/0:1H Not tainted 5.13.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: kblockd blk_mq_run_work_fn RIP: 0010:refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28 Code: e9 db fe ff ff 48 89 df e8 4c 31 e9 fd e9 8a fe ff ff e8 62 a8 a4 fd 48 c7 c7 60 21 c2 89 c6 05 be 76 e5 09 01 e8 fc c0 05 05 <0f> 0b e9 af fe ff ff 0f 1f 84 00 00 00 00 00 41 56 41 55 41 54 55 RSP: 0018:ffffc90008cd78c0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88801fb18000 RSI: ffffffff815c1805 RDI: fffff5200119af0a RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff815bb63e R11: 0000000000000000 R12: ffff8880a9d70ae8 R13: ffffe8ffffc45300 R14: 0000000000000001 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000185f848 CR3: 00000000543ac000 CR4: 00000000001506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __refcount_sub_and_test include/linux/refcount.h:283 [inline] __refcount_dec_and_test include/linux/refcount.h:315 [inline] refcount_dec_and_test include/linux/refcount.h:333 [inline] blk_mq_free_request+0x4d0/0x640 block/blk-mq.c:533 __blk_mq_end_request block/blk-mq.c:558 [inline] blk_mq_end_request+0x41a/0x510 block/blk-mq.c:567 blk_mq_dispatch_rq_list+0xf4d/0x1fa0 block/blk-mq.c:1398 __blk_mq_do_dispatch_sched+0x3bc/0x910 block/blk-mq-sched.c:191 blk_mq_do_dispatch_sched block/blk-mq-sched.c:204 [inline] __blk_mq_sched_dispatch_requests+0x361/0x490 block/blk-mq-sched.c:325 blk_mq_sched_dispatch_requests+0xfb/0x180 block/blk-mq-sched.c:351 __blk_mq_run_hw_queue+0xd8/0x150 block/blk-mq.c:1499 blk_mq_run_work_fn+0x55/0x70 block/blk-mq.c:1831 process_one_work+0x98d/0x1600 kernel/workqueue.c:2276 worker_thread+0x64c/0x1120 kernel/workqueue.c:2422 kthread+0x3b1/0x4a0 kernel/kthread.c:313 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294

Crashes (1):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2021/05/28 02:34	upstream	d7c5303fbc8a	858ea628	.config	console log	report			info		ci-upstream-kasan-gce-selinux-root	WARNING: refcount bug in blk_mq_free_request

Crashes (1):

Assets (help?)